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1. Claims 1-22 Pending. 

Response to Arguments 

2. • Applicant's arguments, see response, filed 10/13/2006, with respect to the 
rejection(s) of claim(s) 1-22 under USC 103 have been fully considered and are 
persuasive. Therefore, the rejection has been withdrawn. However, upon further 
consideration, a new ground(s) of rejection is made in view of Wolters (U.S. Patent Number 



7,107,339). 



Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

4. Claims 1-22 rejected under 35 U.S.C. 102(e) as being anticipated by Wolters 
(U.S. Patent Number 7,107,339). 
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As per Claims 1 , 8, 15, and 22, Wolters discloses a method in a data processing 
system having a program, computer readable medium, and data processing system the 
method comprising the steps performed by the program of: generating a dataset having 
at least one exposure level to failure of a computer-based system a description (i.e. 
"Embodiments of the present invention combine measurements from numerous monitors. These monitors 
collect data from a number of components and subcomponents of an enterprise's IT infrastructure, and 
provide the data regarding each of the components. Using the combined measurements, historical values 
of the monitors, and statistical analysis, embodiments of the present invention can predict that the IT 
infrastructure will not perform up to specification in the future. If the IT infrastructure is already not 
performing up to specification, embodiments of the present invention can suggest possible problems 
causing the out-of-compliance condition, and may even suggest solutions to those problems. This may be 
accomplished by using combined measurements and statistical analysis in a process herein referred to 
as "fingerprinting. " As used in this description, a fingerprint is synonymous with the term "indicator set, " a 
more general if somewhat less colorful term... The measurements received from the monitors may be in 
various forms and formats. A measurement may be raw data such as "memory utilization 70 percent" 
The measurement may be statistically or otherwise preprocessed. The measurement may also be a 
monitor state. Such a state may be binary, e.g., "computer on/off-line," or graduated, e.g. "CPU usage 
high/medium/low. " Other states are also possible, such as trend indicator states, for example, "CPU 
usage increasing/decreasing. " Statistical states may also be used, such as "CPU usage outside normal 
range."" The preceding text excerpt clearly indicates that datasets are generated and collected which 
indicate at least one exposure level to failure (e.g. degrees of memory utilization, on/off states, etc. which 
indicate how close to failing a component may be according to a gross level rule) for a given component 
in a computer based system.) (Column 2, Lines 49-67; Column 5, Lines 25-34) and a corresponding 
rule identifier of a rule used to calculate the exposure level (i.e. "The specifications for an IT 
infrastructure may be provided in terms of gross-level rules. A gross-level rule, such as a business rule, 
indicates the expected or desired functioning of the IT infrastructure. For example, a gross-level rule may 
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specify a maximum or average response time for a web server request Another gross-level rule may 
similarly specify the number of order lines that should be processed per second. Other gross-level rules 
may give constraints on transaction throughput. There are many other various gross-level rules, some of 
which may be unique to the enterprise whose IT infrastructure is being monitored. The IT infrastructure 
may be said to be functioning according to specification if all, or at least a certain minimum number, of the 
gross-level rules are in compliance. If a gross-level rule is not in compliance, corrective action may be 
desired. An actual monitoring system according to embodiments of the present invention may consider 
all gross-level rules. However, for simplicity, only compliance with one gross-level rule is considered in the 
following discussion. Also, since not all components are related to all gross-level rules, the following 
discussion assumes that a gross-level rule has been selected for analysis, and that the components and 
subcomponents that may affect the gross-level rule have been identified. " The preceding text excerpt 
clearly indicates that the exposure levels are based on gross level rules and that the component-rule 
relations which the dataset describes are defined. This indicates that the dataset includes a rule-identifier 
that links the data to the gross-level rule.) (Column 4, Lines 56-67; Column 5, Lines 1-12), the rule 
asynchronously receiving information about the computer-based system and calculating 
the exposure level based on the received information (i.e. "Once the components that are 
relevant to a gross-level rule are identified, an indicator set for the gross-level rule can be created. The 
generation of the indicator set, or fingerprint, is now described with reference to FIG. 3. First, all or a 
critical number of monitors report their measurements, referred to herein as component metrics, and 
these component metrics are received 302 at the Indicator Engine. These measurements may be 
timestamped or synchronized, if temporal measurement synchronization is desired. The measurements 
may be collected periodically. There may be numerous triggering events to be used to commence the 
fingerprint creation process." The preceding text excerpt clearly indicates that the information reception 
and processing is only synchronized when it is desired to synchronize the procedure, thus the default 
operating condition would be asynchronous.) (Column 5, Lines 13-24); comparing the generated 
dataset to a previously generated dataset by comparing the at least one exposure level 
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of the dataset to an at least one exposure level with the same rule identifier in the 
previously generated dataset (i.e. "When the raw monitor measurements, i.e., component metrics, 
are collected, each component metric may be compared 304 with historical values or statistics for the 
component metrics." The preceding text excerpt clearly indicates that exposure levels (e.g. component 
metrics) are compared with historical values (e.g. previous datasets) for the same component-rule 
relation.) (Column 5, Lines 35-38), the previously generated dataset being associated with a 
known problem with the computer-based system (i.e. "The historical indicator sets may have 
been generated at some time in the past, and may be stored in some memory element or database 
somewhere in the IT infrastructure or the Indicator Engine. The historical indicator set may be associated 
with one or more problems that existed at the time the historical indicator set was generated. Also, a 
historical indicator set may be associated with one or more fixes or solutions that were used at the time 
the historical indicator set was generated. For example, if the historical fingerprint was generated when 
the gross-level rule was out of compliance because a particular memory unit was overloaded, the 
historical fingerprint may now be associated with the memory unit being overloaded. Furthermore, ifin the 
past reconfiguring a router eased the memory unit's loading, this fix may also be associated with the 
historical fingerprint." The preceding text excerpt clearly indicates that the previously generated dataset 
may be associated with a know problem that was previously experienced in the computer based system. ) 
(Column 6, Lines 59-67; Column 7, Lines 1-6); and calculating the probability of a problem with 
the computer-based system based on a number of exposure levels in the generated 
dataset matching exposures levels in the previously generated dataset (i.e. in a complex 
IT infrastructure, the CPU monitor alone would not indicate the critical nature of the CPU to the gross- 
level rule. Alternatively, the CPU may not even be monitored. However, since embodiments of the 
present invention consider numerous monitors, the crashed CPU may create recurring monitor patterns 
even without being directly monitored. Thus, in this example, if the two fingerprints match-meet the 
resemblance condition-then the problem that the CPU has again crashed will be inferred. If more than 
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one problem is associated with a given fingerprint the problems may be ranked according to some 
statistical likelihood of reoccurrence... Some embodiments of the invention that may predict a future out- 
of-compliance condition before it occurs are now described with reference to FIG. 6. Since, the gross- 
level rule is not yet out of compliance at the time the monitor data is collected, these embodiments may 
be used to predict whether the gross-level rule is approaching an out-of-compliance condition. In one 
embodiment of the invention, the prediction process is periodically performed for each gross-level rule. 
Thus, the prediction process according to one embodiment of the invention may begin with the selection 
602 of a particular gross-level rule. Then, an indicator set for the selected gross-level rule may be 
generated 604 in any of the ways described above with reference to FIG. 3. Next, the indicator set is 
compared 606 to historical indicator sets in the manner described with reference to FIG. 4. As discussed 
with reference to FIG. 4, the comparison 606 determines whether there is sufficient resemblance between 
the indicator set and at least one historical indicator set. This resemblance condition may be different . 
from the resemblance condition used above with reference to FIG. 4, or it may be the same resemblance 
condition. The historical indicator sets may have been generated at a time when the gross-level rule was 
out of compliance. If the indicator set does not sufficiently resemble any of the historical indicator sets, 
then no prediction is made about the gross-level rule. The process may begin again by a selection 602 of 
another gross-level rule. However, if the indicator set does match, i.e., sufficiently resemble, a historical 
fingerprint, then it is predicted that the IT infrastructure may soon experience an out-of-compliance 
condition regarding the gross-level rule. That is, it is predicted 608 that the gross-level rule may soon be 
out of compliance. In one embodiment of the invention, the monitoring system may then infer 610 
potential problems, fixes, or solutions associated with the particular historical fingerprint or fingerprints, 
similar to the process described with reference to FIG. 4." The preceding text excerpt clearly indicates 
that depending on the number of exposure levels matching with the historical data, that possible problems 
are indicated and that if multiple possible problems are indicated that the likelihood of each problem is 
also indicated. Also note that because the likelihood of problems are genereated statistically, they will be 
represented as probabilities.) (Column 7, Lines 41-52; Column 9, Lines 59-67; Column 10, Lines 1-28). 
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As per Claims 2, 9, and 16, Wolters discloses outputting the determination of the 
calculated probability of a problem (i.e. "In the illustrated embodiment, a determination is made 
410 as to whether the problem inferred was actually correct. This determination may be performed by a 
technician or in some automated manner." The preceding text excerpt clearly indicates that it may be 
determined by a technician if the problem inferences (e.g. the problems and their associated probabilities) 
were correct. In order for a technician to receive the information to make the determination, the 
information must be output.) (Column 7, Lines 61-64). 

As per Claims 3, 10, and 17, Wolters discloses the output includes a description 
of the problem (i.e. "In the illustrated embodiment, a determination is made 410 as to whether the 
problem inferred was actually correct This determination may be performed by a technician or in some 
automated manner." The preceding text excerpt clearly indicates that it may be determined by a 
technician if the problem inferences (e.g. the problems and their associated probabilities) were correct. In 
order for a technician to receive the information to make the determination, a description of the problem 
must be output.) (Column 7, Lines 61-64). 

As per Claims 4, 11, and 18, Wolters discloses that the exposure level comprises 
an exposure level multiplied by a confidence level of the exposure level, the confidence 
level having a value that is increases each time the corresponding rule calculates the 
exposure level (i.e. "If more than one problem is associated with a given fingerprint, the problems may 
be ranked according to some statistical likelihood of reoccurrence. For example, if a certain problem has 
occurred ten times, and each time a fingerprint resembling a historical fingerprint was generated, then 
that problem is more likely to have reoccurred than a problem that only occurred three times in a similar 
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situation. Furthermore, if more than one historical fingerprint matches the fingerprint the problems 
associated with those fingerprints may also be ranked according to some statistical likelihood. " The 
preceding text excerpt clearly indicates that the exposure levels are weighted according to a confidence 
value (e.g. a value which increases each time an exposure level is calculated/encountered).) (Column 7, 
Lines 49-60). 

As per Claims 5, 12, and 19, Wolters discloses the computer-based system is at 
least one of a data processing system, a component of a data processing system, and a 
computer program (i.e. "Embodiments of the present invention combine measurements from 
numerous monitors. These monitors collect data from a number of components and subcomponents of an 
enterprise's IT infrastructure, and provide the data regarding each of the components." The preceding 
text excerpt clearly indicates that the computer based system is components of a computer based 
system. ) (Column 2, Lines 49-53). 

As per Claims 6, 13, and 20, Wolters discloses that the information about the 
computer related system is received by subscribing to the information (i.e. "An information 
technology (IT) infrastructure may be monitored, and the data thus collected may be used to infer 
problems and predict future conditions. . ..Embodiments of the present invention combine measurements 
from numerous monitors. These monitors collect data from a number of components and subcomponents 
of an enterprise's IT infrastructure, and provide the data regarding each of the components." The 
preceding text excerpt clearly indicates that monitors are set up to collect the information about the 
computer based system. Assigning monitors specifically to collect the information can be considered to 
be a form of subscription to that information.) (Column 2, Lines 7-9, 49-53). 
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As per Claims 7, 14, and 21, Wolters discloses the received information 
comprises at least one of fault information, hardware configuration information, and 
software configuration information about the computer-based system (i.e. "Using the 
combined measurements, historical values of the monitors, and statistical analysis, embodiments of the 
present invention can predict that the IT infrastructure will not perform up to specification in the future. If 
the IT infrastructure is already not performing up to specification, embodiments of the present invention 
can suggest possible problems causing the out-of-compliance condition, and may even suggest solutions 
to those problems. " The preceding text excerpt clearly indicates that the information may be considered 
to be either fault or hardware configuration information.) (Column 2, Lines 52-61). 

Points of Contact 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Hicks whose telephone number is (571) 272- 
2670. The examiner can normally be reached on Monday - Friday 8:30a - 5:00p. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jeffrey Gaffin can be reached on (571) 272-4146. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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